Reading · Kusto Insights · RSS Amplifier

Welcome to a new Monthly Update. We will go through some news and the latest queries. The goal is to provide you, the reader, a quick summary of what is going on in the world of KQL including News and Blogs from the Community as well as from Microsoft.

Ingestion Trend By Hour Of Day

By: Michalis Michalos [GitHub, LinkedIn]

let Timeframe = 7d; // Define the required Timeframe
Usage
| where TimeGenerated >= ago(Timeframe)
| where IsBillable == true
| extend Hour = datetime_part("hour", TimeGenerated)
| summarize IngestedGB = sum(Quantity) / 1000.0 by Hour, Plan
| evaluate pivot(Plan, sum(IngestedGB))
| order by Hour asc
| render columnchart

Source: GitHub

We've handpicked a few blog posts for their insightful content and relevance, yet we acknowledge the wealth of quality submissions from the KQL community. While we can't feature every post, each contribution is valued and vital to our collective knowledge. Stay inspired and keep sharing your perspectives!

Five KQL Threat Hunts Every M365 SOC Should Run This Month - Your Sentinel analytics rules are running. Defender XDR creates incidents automatically. The dashboard shows green across the board. And somewhere in your tenant, an attacker is reading email from an account they compromised nine days ago using a technique that doesn’t match a single rule in your library.

Now You See Me: AADGraphActivityLogs - In my series “Detect threats using *GraphActivityLogs” I covered a lot of the basics on how to use different methods to detect certain reconnaissance tooling based on fingerprinting the specific sequence of requests or the volume of requests made to the Microsoft Graph endpoints. But one of the biggest detection gaps in all this was the Azure AD Graph, the old API on a retirement path that started before some of you might work in cyber security.

Identity threat detection and response: Linking accounts - This blog post covers a Defender for Identity feature that hasn’t received much attention. Despite flying under the radar, it’s a valuable setting for security teams who want to see all user identities across the organization in one unified view.

Microsoft Defender XDR Custom Detection Rules: A Complete Guide & Best Practices - Microsoft Defender XDR custom detection rules have changed a lot in the past year’s. In October 2024, near-real-time (NRT) detections entered preview. In October 2025, custom detections became the default for new rules across Defender XDR and Sentinel. In January 2026, NRT support expanded to Sentinel data. Then in April 2026, Microsoft added a SentinelScope_CF requirement that can stop some analysts from seeing alerts if it’s missed.

Microsoft Authenticator App Details now exposed in Entra SignInLogs - In response to CVE-2026-416151 (Microsoft Authenticator Information Disclosure Vulnerability), Microsoft started exposing the used Microsoft Authenticator app details as part of the Entra ID Sign-In Logs in the AuthenticationAppDeviceDetails column. The information can be queried via KQL. Vulnerable builds include versions prior to 6.2605.2973 (Android) and 6.8.47 (iOS), which have been patched.

[DxBP] Part 2 - Detection Engineering Best Practices: Performance, Readability & Maintenance - In the second part of the DxBP series we deepdive into the logic of the detections. This blog describes multiple best practices that apply to the operators and functions used in your detections to make them better performing, readable and maintainbable. Once you have drafted an awesome query that detects the desired malicious behaviour you need to make sure that it will perform well, EDR vendors only give a certain amount of CPU cycles per tenant. Performance matters.

Check out some of the latest queries added to KQLSearch.com:

Alex Verboon - LinkedIn & GitHub: